CVE-2019-5481: krb5: double-free in read_data() after realloc() fail

Summary: In 'lib/security.c', there is a double-free of the reference 'buf->data' on the teardown path if 'Curl_saferealloc()' fails.

#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    void *ptr = malloc(10);
    if (!ptr)
        return -1;
    int len = 0x7fffffff;
    void *ptr2 = realloc(ptr, len);
    if (!ptr2) {
        printf("Triggered realloc failure\n");
        return 0;
    }
    return -1;
}